Remaining issue

HA shall not accept Home Registration without IPsec while HA (Home Agent) may receive BU from MN as if HA is CN, which is valid, without IPsec
XFRM Selector extension, which allow us to use H bit in BU as a selector
pros: easy to impleent
cons: MH "flag" is very local to BU (is a type of MH); a kind of layer violation
Refer sec_path[] at in-kernel MH receiver
pros: easy to implement
cons: still needs in-kernel MH receiver